protect all-users page behind auth
some more